Apache LDAP API Information Disclosure Vulnerability

Apache LDAP API is a U.S. Apache Apache Software Foundation API for accessing LDAP servers. A security vulnerability exists in Apache LDAP API versions prior to 1.0.2. An attacker can exploit the vulnerability to disclose information including: credentials contained in a request...

Information Disclosure Through Race Condition

apache-ldap-api is vulnerable to information disclosure through a race condition. The vulnerability exists as it is possible for another thread to use the connection before it is secured by TLS, caused by the weak setup of SSL Filter. This could potentially expose sensitive information such as...

Server side request forgery (ssrf)

In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any informati...

CVE-2018-1337

In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any informati...

CVE-2018-1337

In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any informati...

CVE-2018-1337

CVE-2018-1337 affects Apache Directory LDAP API prior to 1.0.2. Root cause: a flaw in the SSL Filter setup allows a thread to reuse a connection before TLS is established, potentially leaking data from a request (including credentials from BIND) when a connection is pulled from the pool. Impact: ...

CVE-2018-1337

In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any informati...

July 18, 2018—KB4338831 (Preview of Monthly Rollup)

None None...

Fedora 27 : php-symfony3 (2018-c8ddc44bbb)

3.3.17 2018-05-25 - security cve-2018-11407 Ldap cast to string when checking empty passwords - security cve-2018-11408 SecurityBundle Fail if security.httputils cannot be configured - security cve-2018-11406 clear CSRF tokens when the user is logged out - security cve-2018-11385 migrating sessio...

Debian DSA-4240-1 : php7.0 - security update

Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language : - CVE-2018-7584 Buffer underread in parsing HTTP responses - CVE-2018-10545 Dumpable FPM child processes allowed the bypass of opcache access controls - CVE-2018-10546 Denial of service via...

[SECURITY] [DSA 4240-1] php7.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4240-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 05, 2018 https://www.debian.org/security/faq -...

Sn1per v5.0 - Automated Pentest Recon Scanner

Sn1per Community Edition is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. Sn1per Professional is Xero Security's premium reporting addon for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage...

Debian DSA-4239-1 : gosa - security update

Fabian Henneke discovered a cross-site scripting vulnerability in the password change form of GOsa, a web-based LDAP administration program. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4239. The text itse...

Debian: Security Advisory (DSA-4240-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4239-1] gosa security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4239-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 03, 2018 https://www.debian.org/security/faq -...

EulerOS 2.0 SP2 : 389-ds-base (EulerOS-SA-2018-1190)

According to the versions of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that 389-ds-base did not properly handle long search filters with characters needing escapes, possibly leading to buffer...

EulerOS 2.0 SP3 : 389-ds-base (EulerOS-SA-2018-1191)

According to the version of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that 389-ds-base did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflow...

EulerOS 2.0 SP2 : php (EulerOS-SA-2018-1217)

According to the version of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP...

Active Directory Reconnaissance: ADRecon

ADRecon is a tool which extracts various artifacts as highlighted below out of an AD environment in a specially formatted Microsoft Excel report that includes summary views with metrics to facilitate analysis. The report can provide a holistic picture of the current state of the target AD...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM PureApplication System

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM PureApplication System. These issues were disclosed as part of the IBM Java SDK quarterly updates in January 2018. IBM PureApplication System has addressed the applicable CVEs. Vulnerability Details CVEID:...